[Security solution] EASE Value Report #228877

stephmilovic · 2025-07-21T21:01:21Z

Summary

Implements new EASE Value report.

localhost_5601_app_security_reports_ai_value_sourcerer=(default_(id_security-solution-default,selectedPatterns_!())) timeline=(activeTab_query,isOpen_!f,query_(expression_%27%27,kind_kuery)) timerange=(global_(linkTo_!(timeline),timeran (1)

To test

Use the Security documents generator to generate 60 days of alert data. Login config for serverless will look like:

  "elastic": {
    "node": "https://localhost:9200",
    "username": "elastic_serverless",
    "password": "changeme"
  },
  "kibana": {
    "node":  "https://localhost:5601",
    "apiKey": "MakeAKey"
  },

Command to generate alerts:

yarn start generate-alerts -n 10000 -h 100 -u 100 --start-date 60d --end-date now

Run attack discovery over the older 30 days of data (60d - 30d). Use API to backdate those attack discoveries to be in the older 30 days:

POST .ds-.adhoc.alerts-security.attack.discovery.alerts-default-2025.07.28-000001/_update/392334c70037396fdd5da31e1e566d4cca5eb38d7c4e88994c305bddf9ce4e8e
{
  "doc": {
    "@timestamp": "2025-06-28T15:16:31.006Z"
  }
}

Run attack discovery on the newer 30 days of data (30d - now)
Now go to the value report and QA! Check my maths. Adjust date ranges, make sure all references adjust (last 30 days). Export PDF and ensure it looks nice.

stephmilovic · 2025-08-01T19:37:19Z

@elasticmachine merge upstream

elasticmachine · 2025-08-01T20:43:28Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 4be4098
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-228877-4be409881713
Security Deployment

Failed CI Steps

FTR Configs #11

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7612	7814	+202

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`maps`	3.1MB	3.1MB	+651.0B
`securitySolution`	9.8MB	10.3MB	⚠️ +474.5KB
total			+475.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`elasticAssistant`	273.7KB	273.7KB	+21.0B
`kbnUiSharedDeps-npmDll`	6.5MB	6.5MB	+10.2KB
`securitySolution`	94.3KB	94.4KB	+105.0B
`securitySolutionEss`	30.6KB	30.6KB	+21.0B
`securitySolutionServerless`	44.1KB	44.2KB	+65.0B
total			+10.4KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
`securitySolution`	641	646	+5

miscellaneous assets size

id	before	after	diff
`securitySolution`	4.9MB	5.0MB	+84.6KB

Total ESLint disabled count

id	before	after	diff
`securitySolution`	739	744	+5

History

💔 Build #325663 failed ed61c0d
💔 Build #325620 failed 1290337
💛 Build #325352 was flaky bd3bd25
💔 Build #325292 failed e1b05fc

kibanamachine · 2025-08-05T21:48:48Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 228877 locally
cc: @stephmilovic

...ublic/common/components/visualization_actions/lens_attributes/ai/cost_savings_metric.test.ts

## Summary Issue: elastic/security-team#14504 [A previous PR](#228877) introduced the EASE Value report and the ability to export it in serverless. This PR makes the report available in ESS and adds logic to export it using the share plugin. The ESS export logic is different from that of serverless because schedule reporting is not available in Serverless yet (ResponseOps [plans](elastic/kibana-team#1847) to add support for it in 9.4). The reporting is initiated in the client's browser when the user clicks on the "Export report" button, which becomes available once the report data and the cost savings trend insight have been fetched and generated respectively. The export report button makes a call to the server to generate a PDF for the report and passes the insight and a hash of the report data as parameters (aka "forwarded state"). A headless browser is used to navigate to a special route `/app/reportingRedirect` that looks up a the corresponding locator locator (in this case, `AIValueReportLocatorDefinition`) which in turns resolves the URL of the value report (`/app/security/reports/ai_value`) _and_ the forwarded state to be stored in `history.location.state`. The value report page reacts to this state being present and renders itself in "export mode". When the components finish loading, the headless browser takes screenshots of everything that is contained within the value report page, which has a `data-shared-items-container` attribute attached to it. Notice that we only forward the insight and the hash of the report data in order to avoid calling an LLM again in the headless browser when the data itself hasn't changed. <img width="2766" height="948" alt="image" src="https://github.com/user-attachments/assets/01fbac58-1450-42e0-a16d-c456e9137878" /> ## How to test 1. Run ESS locally (Elasticsearch and Kibana). Then log in as an admin and navigate to the rules management page (`app/security/rules/management`) to ensure that all indexes are properly initialized. 2. Use the [Security documents generator](https://github.com/enriquesanchez-elastic/security-documents-generator) (fork) to generate 60 days of alert data. By running: `yarn start generate-alerts -n 10000 -h 100 -u 100 --start-date 60d --end-date now` 3. Run Attack Discovery over the 60 days of data that you generated (see the video below) https://github.com/user-attachments/assets/85cdefe8-2fc0-4a9c-ab7c-051ca7188b6f 4. Navigate to the "Value report" page. You can use the link on the left side, or you can go to `/app/security/reports/ai_value`. 5. Once the report loads, the "Export report" button should be enabled. Click on it and export it to a PDF. You should see a toast indicating that the export in ongoing and when it is done you should get a toast with a "Download report" button. Click on "Download report" and verify that the downloaded PDF matches the data that you are seeing on the screen. Play with it by adjusting the time window in the date picker next to the Export report button. https://github.com/user-attachments/assets/e1aea0ad-4b74-4ee3-b329-43181d479328 ## Known issues 1. The icons next to these headings are clearer in the PDF and therefore hard to see PDF <img width="2856" height="254" alt="image" src="https://github.com/user-attachments/assets/849b465b-2efd-4f5d-a907-e5570639e2bd" /> Website <img width="1814" height="166" alt="image" src="https://github.com/user-attachments/assets/9de8da9d-4779-4495-8477-3803d0a3e8e4" /> ## Pending 1. Copy adjustments to the value report button 2. Placement of the value report button in the launchpad 3. Update the documentation on the restricted access view. See elastic/docs-content#3817 4. Follow the instructions after updating the Elastic Assistant prompt. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>

## Summary Issue: elastic/security-team#14504 [A previous PR](elastic#228877) introduced the EASE Value report and the ability to export it in serverless. This PR makes the report available in ESS and adds logic to export it using the share plugin. The ESS export logic is different from that of serverless because schedule reporting is not available in Serverless yet (ResponseOps [plans](elastic/kibana-team#1847) to add support for it in 9.4). The reporting is initiated in the client's browser when the user clicks on the "Export report" button, which becomes available once the report data and the cost savings trend insight have been fetched and generated respectively. The export report button makes a call to the server to generate a PDF for the report and passes the insight and a hash of the report data as parameters (aka "forwarded state"). A headless browser is used to navigate to a special route `/app/reportingRedirect` that looks up a the corresponding locator locator (in this case, `AIValueReportLocatorDefinition`) which in turns resolves the URL of the value report (`/app/security/reports/ai_value`) _and_ the forwarded state to be stored in `history.location.state`. The value report page reacts to this state being present and renders itself in "export mode". When the components finish loading, the headless browser takes screenshots of everything that is contained within the value report page, which has a `data-shared-items-container` attribute attached to it. Notice that we only forward the insight and the hash of the report data in order to avoid calling an LLM again in the headless browser when the data itself hasn't changed. <img width="2766" height="948" alt="image" src="https://github.com/user-attachments/assets/01fbac58-1450-42e0-a16d-c456e9137878" /> ## How to test 1. Run ESS locally (Elasticsearch and Kibana). Then log in as an admin and navigate to the rules management page (`app/security/rules/management`) to ensure that all indexes are properly initialized. 2. Use the [Security documents generator](https://github.com/enriquesanchez-elastic/security-documents-generator) (fork) to generate 60 days of alert data. By running: `yarn start generate-alerts -n 10000 -h 100 -u 100 --start-date 60d --end-date now` 3. Run Attack Discovery over the 60 days of data that you generated (see the video below) https://github.com/user-attachments/assets/85cdefe8-2fc0-4a9c-ab7c-051ca7188b6f 4. Navigate to the "Value report" page. You can use the link on the left side, or you can go to `/app/security/reports/ai_value`. 5. Once the report loads, the "Export report" button should be enabled. Click on it and export it to a PDF. You should see a toast indicating that the export in ongoing and when it is done you should get a toast with a "Download report" button. Click on "Download report" and verify that the downloaded PDF matches the data that you are seeing on the screen. Play with it by adjusting the time window in the date picker next to the Export report button. https://github.com/user-attachments/assets/e1aea0ad-4b74-4ee3-b329-43181d479328 ## Known issues 1. The icons next to these headings are clearer in the PDF and therefore hard to see PDF <img width="2856" height="254" alt="image" src="https://github.com/user-attachments/assets/849b465b-2efd-4f5d-a907-e5570639e2bd" /> Website <img width="1814" height="166" alt="image" src="https://github.com/user-attachments/assets/9de8da9d-4779-4495-8477-3803d0a3e8e4" /> ## Pending 1. Copy adjustments to the value report button 2. Placement of the value report button in the launchpad 3. Update the documentation on the restricted access view. See elastic/docs-content#3817 4. Follow the instructions after updating the Elastic Assistant prompt. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>

stephmilovic added 23 commits July 2, 2025 15:06

create page and mock stats

9d7f05d

fix %

6a85cf8

better

61c6202

Merge branch 'main' into ai_value

0338448

aiValueDashboard => aiValue

fba2ad8

getting actual data

28fd392

4 to 8

f31517a

Merge branch 'main' into ai_value

4f827d1

Merge branch 'main' into ai_value

2655882

Merge branch 'main' into ai_value

dd0aa3f

value report time range

3b77928

Merge branch 'main' into ai_value

d17c566

Merge branch 'main' into ai_value

3958ddc

cssing

4715391

Merge branch 'main' into ai_value

74c94e6

good progress

f03b13d

fix query

38fcc8a

compare perc

ce4d73b

more

4e08f52

component breakup

d2c6893

next row + cleanup

d21d1f6

add loading

9d5c97a

undo

da3d361

stephmilovic added release_note:enhancement Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v9.2.0 labels Jul 21, 2025

stephmilovic added 2 commits July 22, 2025 10:06

more components

e91c993

to metric

fe0ca27

stephmilovic added 4 commits July 31, 2025 12:16

nits from Philippe

009e34d

Merge branch 'main' into ai_value

8bd0cb5

memoize timerange

e1b05fc

valueReport in url on serverless only

bd3bd25

stephmilovic added the ci:project-deploy-ai4soc Create an AI for SOC Security Serverless Project label Aug 1, 2025

stephmilovic added 4 commits August 1, 2025 08:47

jspdf to pdf-lib

1d07c13

no need to hide badges!

3ea9216

style fixes

1290337

fix tests

ed61c0d

Merge branch 'main' into ai_value

4be4098

stephmilovic enabled auto-merge (squash) August 1, 2025 19:41

stephmilovic merged commit 475746c into elastic:main Aug 1, 2025
13 checks passed

szaffarano pushed a commit to szaffarano/kibana that referenced this pull request Aug 5, 2025

[Security solution] EASE Value Report (elastic#228877)

98e85c0

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Aug 5, 2025

delanni pushed a commit to delanni/kibana that referenced this pull request Aug 5, 2025

[Security solution] EASE Value Report (elastic#228877)

5c91f01

stephmilovic added backport:skip This PR does not require backporting and removed backport missing Added to PRs automatically when the are determined to be missing a backport. backport:version Backport to applied version labels labels Aug 5, 2025

wildemat mentioned this pull request Aug 7, 2025

pr 230826 #231022

Closed

10 tasks

nickofthyme reviewed Aug 10, 2025

View reviewed changes

...ublic/common/components/visualization_actions/lens_attributes/ai/cost_savings_metric.test.ts Show resolved Hide resolved

NicholasPeretti pushed a commit to NicholasPeretti/kibana that referenced this pull request Aug 18, 2025

[Security solution] EASE Value Report (elastic#228877)

695b2b4

jeramysoucy mentioned this pull request Sep 9, 2025

[Observability] Package for capturing screenshot #225978

Closed

benakansara mentioned this pull request Sep 12, 2025

[Incident Management] Take screenshot of any page #225640

Closed

denar50 mentioned this pull request Nov 19, 2025

[Security Solution] Enable Value Reports in ESS #243511

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security solution] EASE Value Report #228877

[Security solution] EASE Value Report #228877

Uh oh!

stephmilovic commented Jul 21, 2025 •

edited

Loading

Uh oh!

stephmilovic commented Aug 1, 2025

Uh oh!

elasticmachine commented Aug 1, 2025 •

edited

Loading

ESLint disabled line counts

miscellaneous assets size

Total ESLint disabled count

Uh oh!

Uh oh!

kibanamachine commented Aug 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

[Security solution] EASE Value Report #228877

[Security solution] EASE Value Report #228877

Uh oh!

Conversation

stephmilovic commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

To test

Uh oh!

stephmilovic commented Aug 1, 2025

Uh oh!

elasticmachine commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

Page load bundle

ESLint disabled line counts

miscellaneous assets size

Total ESLint disabled count

History

Uh oh!

Uh oh!

kibanamachine commented Aug 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

stephmilovic commented Jul 21, 2025 •

edited

Loading

elasticmachine commented Aug 1, 2025 •

edited

Loading